Privacy Policy

SportXAPI ("we", "us", "our") collects and processes personal information strictly necessary to provide reliable cricket data infrastructure, API services, and customer accounts:

• Account Information: Name, work email address, organization/company name, and hashed credentials when you register via our dashboard or authenticate through Google/GitHub OAuth.
• Billing & Settlement: Transaction IDs, invoice histories, and payment event statuses (handled directly via licensed gateways including Stripe). Full debit/credit card numbers and private crypto keys are never stored on our infrastructure.
• Operational Telemetry: API keys, request volumes, timestamps, endpoint targets, HTTP status responses, source IPs, and rate limit counters for quota enforcement, anti-abuse, and SLA monitoring.
• Communications: Direct messages, bug reports, and correspondence submitted to our technical support channels.

We do not collect, harvest, or monetize the end-user data of applications powered by our APIs beyond aggregate protocol telemetry.

We process personal data under GDPR Article 6(1)(b) (contract performance) and Article 6(1)(f) (legitimate enterprise interests):

• Authenticating developer access, provisioning API tokens, and maintaining active portal sessions.
• Metering endpoint queries, enforcing per-tier Rate Limits (RPS / RPM), and generating monthly usage bills.
• Dispatching transactional platform notifications (OTP verification codes, key exhaustion warnings, critical security notices, and scheduled maintenance bulletins).
• Detecting, mitigating, and preventing abusive scraping behavior, distributed denial-of-service (DDoS) attempts, and key compromised events.

We maintain high vendor standards and partner only with enterprise infrastructure providers bound by rigorous data protection and confidentiality agreements:

• Google Cloud Platform (GCP): Primary cloud hosting, virtual machine compute, and secured database clusters located in compliant data centers.
• Cloudflare Inc.: Global CDN edge distribution, TLS/SSL termination, and DDoS mitigation.
• Stripe, Inc.: Regulated global payment gateway processing credit/debit cards, digital wallets, and automated subscription billing.
• Redis Labs & Internal In-Memory Clusters: Ephemeral rate limiting, token quota enforcement, and live socket state.
• Resend / Google SMTP: Transactional email delivery for authentication OTPs and system bulletins.

We enforce strict retention schedules across all operational data tiers:

• Customer Account Records: Retained for the active lifecycle of your account plus 90 days following formal account closure.
• Operational API Logs: Raw query telemetry is retained for 30 rolling days for diagnostic debugging, after which it is anonymized into aggregate metrics.
• Financial Records: Invoices and transaction references are archived for 7 years to satisfy statutory tax and financial auditing mandates.
• Security Controls: All data in transit is encrypted using TLS 1.3. At-rest credentials and API tokens are salted and hashed using industry-standard bcrypt/HMAC algorithms.

Depending on your jurisdiction, you have extensive legal rights regarding your personal information, including:

• Right to Access & Portability: Request an export of all account profile records and historical billing receipts.
• Right to Rectification: Update obsolete or incorrect details directly in your customer dashboard or via support request.
• Right to Erasure ("Right to be Forgotten"): Request the complete purging of your personal records and deactivated API tokens.
• Right to Object & Restrict Processing: Request restrictions on specific non-essential data telemetry operations.